Privacy

Last updated 25 September 2026

This explains what petal collects, why, and what you can do about it. We follow Singapore's Personal Data Protection Act (PDPA) and treat guests from elsewhere the same way.

What we collect

• Hosts: your name, email address and profile picture from Google sign-in, the galleries you make and their settings.
• Guests: the photos and videos you add and the name you type. Guests don't make an account. Your phone keeps a random ID so you can find and remove your own photos; we store only a scrambled form of it.
• Payments: Stripe handles card details. We receive only what we need: that you paid, the amount, and a customer reference.
• To keep things running: a scrambled form of your network address, to stop runaway uploads, and short-lived service logs.

We don't use advertising trackers or sell anyone's information.

Who can see what

• Anyone with a gallery's link can see its photos and the names beside them. The host decides who gets the link.
• The host, and helpers they invite, can see, hide, delete and download every photo in their gallery.
• We use Cloudflare to store and serve petal (photos may be stored outside Singapore), Google for sign-in, and Stripe for payments. Each handles data only to provide its service to us.

How long we keep it

• Photos stay for the gallery's keeping period (30 days on free, a year when unlocked), then they're deleted, along with anything removed more than 30 days ago.
• Deleting a gallery removes its photos and settings. Account details stay until you ask us to delete your account.

Your choices

• Guests can remove their own photos from the gallery on the same phone, or ask the host.
• Anyone can ask us for a copy of their information, to correct it, or to delete it. Write to hello@petalwall.app and we'll reply within 30 days.